Consumer Health Data Privacy Notice

This notice explains how Dr. Tatiana Leal’s aesthetic medicine practice handles consumer health data of visitors and prospective patients located in the United States, as required by the Washington My Health My Data Act (RCW 19.373) and Nevada Senate Bill 370 (2023). All medical services are provided in person in Bogotá, Colombia. Patient care itself is governed by Colombian law, as described in our Privacy Notice and Data Processing Policy.

1. Who is responsible for your health data

2. Health data we collect from the website, email and WhatsApp

“Consumer health data” means personal information that identifies or could reasonably be linked to you and describes your past, present or future physical health. On this website it can include:

• The treatment you tell us you are interested in, chosen in the contact form or written in an email or WhatsApp message (for example, a thread lift, botulinum toxin or tattoo removal).
• Anything you choose to write about your health in a message: concerns about an area of your body, previous treatments, medications or allergies. The form asks you not to include medical history or photos; we request them later through a secure channel only if you book an assessment.
• Your browsing of treatment pages, recorded by our analytics tools (pages viewed, time on page, clicks and, with Microsoft Clarity, session recordings and heatmaps). Because those pages describe medical treatments, this activity could reveal an interest in a health service.

Together with that data we receive your name, email address, phone number (optional in the form), country or city if you mention it, the page from which you contacted us, and technical data such as IP address, browser and device.

3. Where the data comes from

• Directly from you, when you fill in the form, email us, call us or message us on WhatsApp.
• From your browser or device, through the analytics and security tools listed in section 5, when you visit the website.

We do not buy health data and we do not receive it from data brokers.

4. Why we use it

• To answer your inquiry and send you the information or quote you asked for.
• To schedule and prepare an in-person assessment in Bogotá if you decide to book one.
• To keep the website secure and block spam (Cloudflare Turnstile).
• To measure which pages and contact channels work, so we can improve the website (Google Analytics through Google Tag Manager, Microsoft Clarity, Ahrefs Web Analytics).

We collect and share consumer health data only with your consent or when it is necessary to provide the service you request. Sending us the form, an email or a WhatsApp message about a treatment is the request; we use what you send only to answer it. We never use your health data for purposes you did not request.

5. Who receives it: processors and other third parties

We do not sell consumer health data and we do not share it with third parties for their own purposes. These service providers process it on our behalf:

Advertising tags managed through Google Tag Manager stay off until you accept advertising cookies in the cookie notice. [dato: advertising platforms active in Google Tag Manager]

We may also disclose data when Colombian or US law requires it, for example in response to a court order.

6. How long we keep it

We keep inquiry data (form, email and WhatsApp) for [dato: retention period for inquiries that do not become patients]. If you become a patient, your clinical record is kept as required by Colombian health regulations, as explained in our Privacy Notice. Analytics data is kept according to each provider’s retention settings.

7. Your rights over your consumer health data

You have the right to:

• Confirm and access: know whether we collect, share or sell your consumer health data, get a copy of it, and receive the list of all third parties and affiliates with whom we shared it, with their contact information.
• Delete: ask us to delete your consumer health data, including from our service providers’ systems. Data that Colombian law requires us to keep in a clinical record is the only exception, and we will tell you if it applies.
• Withdraw consent: withdraw your consent to the collection or sharing of your consumer health data at any time. Withdrawal does not affect what was done before it.
• Appeal: if we refuse your request, you can ask us to reconsider it.

We will not discriminate against you for exercising these rights.

8. How to exercise your rights

Send your request to asistentetatianaleal@gmail.com with the subject “Consumer health data request”. Tell us what you want (access, deletion or withdrawal of consent) and give us an email or phone number we can use to verify your identity. You may also make the request through an authorized agent, who must show your signed authorization.

We respond within 45 days of receiving your request. If we need more time, we will tell you why, and the extension will not exceed another 45 days. Requests are handled at no cost, up to twice a year.

Appeals: if we deny your request, reply to our decision within a reasonable time asking for an appeal. We will answer within 45 days and explain our reasons. If the appeal is denied, Washington residents can contact the Washington State Attorney General at atg.wa.gov and Nevada residents can contact the Nevada Attorney General at ag.nv.gov.

9. Location data and geofencing

We do not set up geofences around health care facilities and we do not use precise location data to send you messages or advertising.

10. Changes to this notice

We will publish any change on this page and update the “Last updated” date at the top. If a change affects how we use data you already gave us, we will ask for your consent again before applying it.